It is described on http://shinnai.altervista.org/exploits/SH-008-20101026.html


Thanks to geal for helping finding the problem
(cherry picked from commit b531955c2206c88250cacc511793facc32cbced6)

Signed-off-by: Rafaël Carré <rafael.carre@gmail.com>